The nsssd-switch program

nsssd-switch is a daemon providing a backend for clients using the nsss library - more precisely, clients using the nsss-all or the nsss-switch functions.

The nsssd-switch backend is the real point of the nsss package: it allows a complex configuration using different other backends, similarly to the /etc/nsswitch.conf mechanism but without its drawbacks:


     s6-ipcserver -l0 /run/service/nsssd/s nsssd-switch [ -t timeout ] bitfield1 backend1... "" bitfield2 backend2... "" ...

or, in an execline script:

     s6-ipcserver -l0 /run/service/nsssd/s
       bitfield1 { backend1... }
       bitfield2 { backend2... }

Exit codes

These exit codes are not important because only the super-server can see them.


Environment variables

nsssd-switch can read a number x in the NSSSD_TIMEOUT environment variable. If this variable is present and valid, it means that nsssd-switch will die if x milliseconds elapse without the client reading or writing during a nsss protocol exchange, which usually means the client either is not speaking the protocol correctly or has become unresponsive. It is a safety measure to avoid having nsssd processes sticking around forever when a client is buggy.

Note that the NSSSD_TIMEOUT variable refers to a timeout during an exchange with the client, while the argument to the -t option refers to a timeout enforced on the backends.


A bitfield is a value between 0 and 7, representing 3 bits. If a bit is 0, it means that the query resolution will continue to the next backend if the corresponding failure condition is triggered. If the bit is 1, it means that the failure will instantly be reported to the client and the query will not be transmitted to the next backend in the chain.

So, for instance, a bitfield of 5 means: report failure to the client if the current backend is in a failed state or if a requested entry cannot be found. Proceed to the next backend if the current backend reports failure when processing a query.

This format allows the administrator to configure various fallback strategies. Note that in case of success, the requested data is immediately returned to the client. nsssd-switch does not provide the equivalent of the merge directive in /etc/nsswitch.conf.